AI regulation: EU AI Act fines reach 7% of global turnover

The AI regulation that reaches Brazilian companies in October 2026 consists of a European law in force and a Brazilian law still in bill form. Regulation (EU) 2024/1689, known as the AI Act, already punishes the use of prohibited AI practices with fines of up to 35 million euros or 7% of total worldwide annual turnover for the preceding financial year, whichever is higher, including for companies outside the European Union whose system produces output used there (European Parliament and Council, 2024). In Brazil, bill PL 2338/2023 was approved by the Federal Senate on December 10, 2024, reached the Chamber of Deputies on March 17, 2025 and, on October 22, 2026, appeared in the official database as “Awaiting Report” in the special committee (Chamber of Deputies, 2026). Until the law comes, the LGPD, Brazil’s data protection law, and the ANPD, its data protection agency, govern the use of AI with personal data in the country. This article is informational and does not replace legal advice.

At Iasbeck&Co we implement CRM and AI agents in B2B operations, and the question “is there an AI law in Brazil yet?” comes up in almost every board conversation. I organized the dates, fines and status of each rule, checked against the legal text and the official legislative record, for the board, business leaders, legal and HR. How AI fits into the LGPD is covered in AI and LGPD, and I don’t repeat it here.

Which official sources show the state of AI regulation?

I used legal texts, official legislative records and one academic report. News coverage of PL 2338 is inconsistent, so I checked every date in the open data of the Chamber of Deputies and the Senate.

Source	Year	Type and method	Main finding
Regulation (EU) 2024/1689, AI Act	2024	Legal text	Fines of up to 7% of worldwide turnover for prohibited practices
Regulation (EU) 2026/1744, Digital Omnibus on AI	2026	Legal text of 8 July 2026	Postpones high-risk rules to December 2027 and August 2028
Federal Senate, PL 2338/2023 and Chamber of Deputies, legislative record	2024 to 2026	Official legislative record, checked on 10/22/2026	Approved by the Senate on 12/10/2024; awaiting report in the Chamber
ANPD, Regulatory Agenda 2025-2026 progress report	2026	Official report for the first half of the year	AI in Phase 1, focused on LGPD art. 20; draft rule in preparation
Stanford HAI, AI Index Report 2026	2026	Academic report; laws passed in the G20 (Digital Policy Alert data)	11 AI-related laws in the G20 in 2025, down from 16 in 2024; 150 US state laws
Stanford HAI, AI Index Report 2025	2025	Mentions of AI in legislative proceedings of 75 countries and territories	1,889 mentions in 2024, up 21.3%

What does the EU AI Act require, and when?

The AI Act classifies AI uses by risk. At the top are the prohibited practices of Article 5, such as social scoring and emotion recognition in the workplace. Below them come the high-risk systems of Annex III, which include recruitment, decisions on promotion and termination, and creditworthiness assessment of individuals. There are also transparency obligations for chatbots and synthetic content (Article 50) and rules for providers of general-purpose AI models (European Parliament and Council, 2024).

The regulation entered into force on August 1, 2024, with staggered application (Article 113). In July 2026, the EU adopted Regulation 2026/1744, the Digital Omnibus on AI, which postponed the high-risk obligations because, according to the text itself, delays in technical standards and in setting up national authorities threatened the original date of August 2, 2026 (European Parliament and Council, 2026). The current timeline is:

Date	What applies
February 2, 2025	General provisions, AI literacy (Article 4) and prohibited practices (Article 5)
August 2, 2025	Rules for general-purpose models, governance and the penalty regime
August 2, 2026	General application, including Article 50 transparency
December 2, 2026	New Omnibus prohibitions on non-consensual intimate imagery and child abuse material
December 2, 2027	Annex III high-risk systems, such as recruitment and credit
August 2, 2028	High-risk AI embedded in regulated products under Annex I

The postponement left transparency on the original schedule. The provider of a chatbot that talks to people in Europe must make sure they know they are dealing with an AI, unless that is obvious, and whoever uses emotion recognition must inform the people exposed to it (Article 50(1) and (3)).

How much can non-compliance with the AI Act cost?

Article 99 sets three tiers, always using the higher of the fixed amount and the percentage of worldwide turnover. The Omnibus kept the caps and extended to small mid-caps the rule for SMEs, which pay the lower of the two amounts, in the tiers of paragraphs 4 and 5 (European Parliament and Council, 2026).

Infringement	Maximum fine	Provision
Use of a prohibited practice	35 million euros or 7% of worldwide turnover	Art. 99(3)
Breach of obligations of providers, deployers and other operators, including transparency	15 million euros or 3% of worldwide turnover	Art. 99(4)
Incorrect, incomplete or misleading information to authorities	7.5 million euros or 1% of worldwide turnover	Art. 99(5)
Provider of a general-purpose AI model	15 million euros or 3% of worldwide turnover, imposed by the Commission	Art. 101

Does the AI Act reach Brazilian companies?

Article 2 applies the regulation to providers placing AI systems on the European market, wherever they are established, and to providers and deployers in third countries “where the output produced by the AI system is used in the Union”. That covers, for example, a Brazilian software company with European customers and a hiring process that uses AI to screen candidates who will work there. For companies operating only in Brazil, the AI Act works as a reference, because PL 2338 follows the same risk-based logic.

Where does PL 2338/2023 stand in October 2026?

The bill by Senator Rodrigo Pacheco was approved by the Senate floor on December 10, 2024 (Federal Senate, 2024). The Chamber of Deputies received the text on March 17, 2025, set up a special committee in April and appointed Deputy Aguinaldo Ribeiro (PP-PB) as rapporteur on May 20. On October 22, 2026, the official record showed “Awaiting Report”, under priority procedure, and every entry since March consisted of other AI bills being attached to it, the latest on September 2, 2026 (Chamber of Deputies, 2026).

One of the attached bills changes the structure of the law. In December 2025, the federal government sent PL 6237/2025, which creates the National System for the Development, Regulation and Governance of Artificial Intelligence (SIA) and designates the ANPD to set general rules and regulate sectors without their own regulator. According to the Ministry of Management, the text fixes a constitutional flaw of initiative in PL 2338 and leaves the prohibitions and the high-risk list to it (Ministry of Management and Innovation, 2025). PL 6237 was attached to PL 2338 on April 6, 2026. Forecasts of a vote after the October elections circulate, with no date recorded in any official source.

What does the text approved by the Senate say?

The text sent to the Chamber follows the architecture of the AI Act, with its own penalties and deadlines, and the Chamber can change any part of it, which would send the bill back to the Senate (Chamber of Deputies, text received from the Senate).

Topic	AI Act (in force in the EU)	PL 2338/2023 (Senate text, under review)
Prohibited uses	Art. 5, such as social scoring and emotion recognition at work	Art. 13, “excessive risk”, such as exploiting vulnerabilities and social scoring by public authorities
High risk affecting companies	Recruitment, worker management, credit for individuals	Recruitment and worker evaluation, access to essential services, emotion recognition (art. 14)
Rights of affected people	Transparency and explanation in defined cases	Information about interacting with AI for any system (art. 5); explanation, contestation and human review for high risk (art. 6)
Maximum fine	35 million euros or 7% of worldwide turnover	R$ 50 million per infringement or 2% of gross revenue in Brazil (art. 50)
Who enforces	National authorities and the Commission’s AI Office	ANPD as coordinator of the SIA, with sector regulators (art. 45)
When it applies	Staggered from 2025 to 2028	730 days after publication, with some rules after 180 days (art. 80)

Both texts classify by risk, and the bill treats a preliminary assessment as good practice (art. 12). If the Senate text were signed into law unchanged, most obligations would apply only two years after publication. The Brazilian law demands nothing from your operation in 2026, even a quick approval would push most obligations to 2029 or later, and its design already shows what will be required.

What already applies in Brazil: the LGPD and the ANPD

Without a specific law, the LGPD governs today’s use of AI with customer, lead and candidate data, and Article 20, on the review of automated decisions, is the most direct point of contact. The ANPD placed artificial intelligence among the 16 items of its Regulatory Agenda 2025-2026, in Phase 1, the highest priority. The progress report for the first half of 2026 says the project seeks to address Article 20 of the LGPD without being limited to it, that the technical note consolidating public input is complete and that the draft rule is being prepared by the technical team (ANPD, 2026).

The authority itself changed status. Law No. 15,352 of February 25, 2026, which converted Provisional Measure No. 1,317/2025, amended the LGPD to turn the ANPD into the National Data Protection Agency. And the authority has already acted in an AI case: on July 2, 2024, it ordered the precautionary suspension of the privacy policy of a large social media platform that allowed the use of data published by users to train generative AI, with a daily fine of R$ 50,000 for non-compliance (ANPD, 2024). It was a preventive measure based on the LGPD that already exists.

How many AI laws does the world pass each year?

The Stanford AI Index tracks legislative activity with two yardsticks. In the 2026 edition, the count of AI-related laws passed in G20 countries, based on Digital Policy Alert data, starts at zero in 2016, reaches 16 in 2024 and falls to 11 in 2025. For 2016 to 2025 combined, the United States leads with 25 laws, followed by South Korea with 17, and Brazil has 3. The report warns that the dataset covers enacted legislation only, that a large bill with many AI provisions counts as one, and that volume does not measure significance (Stanford HAI, 2026).

The most intense activity is in US states. The number of AI-related state laws passed in the United States went from fewer than 10 in 2020 to 150 in 2025, led by California (20 in 2025), while federal policy moved toward deregulation (Stanford HAI, 2026). The 2025 edition measured debate by how often “artificial intelligence” appears in the legislative proceedings of 75 countries and territories: there were 1,889 mentions in 2024, up 21.3% from 1,557 in 2023 and more than nine times the 2016 figure (Stanford HAI, 2025).

The G20 decline in 2025 sits alongside a record in US states and an AI Act being adjusted rather than expanded. I read these numbers as a sign that AI regulation has become a patchwork of sector, state and data protection rules, which adds work for anyone operating in several countries. Adoption numbers and the risks companies perceive are in the state of AI in companies.

What these data do not tell you

The status of PL 2338 is a snapshot of October 22, 2026. The Chamber’s record shows what was registered, and the negotiation of the rapporteur’s text happens outside it. The comparison with the AI Act also has limits, because it sets a law in force beside a text the Chamber can still rewrite.

The AI Index counts depend on definitions. The 2026 edition changed its method and now looks only at the G20, so the two editions are not comparable, and the “3 laws in Brazil” come from a dataset that searches for AI-related legislation without saying whether any of them affects your operation. The count of mentions measures debate, which creates no obligation.

Fine caps show the maximum and say little about what an authority imposes in each case, which depends on gravity, duration, cooperation and company size (Art. 99(7)). I also found no consolidated official figure for fines already imposed under the AI Act, so I cite none.

What leadership does with these numbers

The LGPD, the AI Act for those with European operations and the direction of PL 2338 are enough to get your house in order. This is the plan I propose.

1. Inventory your AI uses. List tools, AI agents and automations in sales, marketing, service and HR, with owner, the data they read and the decision they influence, including what the team uses on its own.
2. Classify each use by risk. Use the AI Act and art. 14 of the bill as a yardstick, even without a legal obligation, with the table below as a starting point.
3. Tell customers when they are talking to an AI. Article 50 of the AI Act already requires this in Europe, and art. 5 of the bill provides a right to information for any system. Adjust your service agent’s opening and your privacy notice.
4. Document the higher-risk uses. For each one, write down the decision criteria, who reviews it and how the affected person requests review. That record meets LGPD Article 20 today and works as the preliminary assessment the bill’s art. 12 treats as good practice.
5. Turn it into internal policy. Approved tools, permitted data, human review and an agent register fit into an AI use policy, which also covers reviewing vendor contracts.
6. Put the calendar on the agenda. Mark December 2, 2027 if you run high-risk AI with effects in Europe, and check the PL 2338 record and the ANPD agenda every quarter.

Common use in the operation	Under the AI Act	Under PL 2338 (Senate)	Already applies in Brazil
Chatbot or service agent	Article 50 transparency	Right to information (art. 5)	LGPD, purpose and transparency
Email drafts and meeting summaries	No specific obligation beyond literacy	Outside high risk	LGPD, if personal data is involved
B2B lead scoring	Generally outside Annex III	Generally outside art. 14	LGPD art. 20, if the decision affects the person
CV screening and performance evaluation	High risk (Annex III, point 4)	High risk (art. 14, III)	LGPD art. 20
Credit assessment of individuals	High risk (Annex III, point 5)	High risk if it concerns access to an essential service (art. 14, IV)	LGPD art. 20
Emotion recognition on calls	Prohibited for employees; high risk otherwise	High risk (art. 14, XI)	LGPD; sensitive data rules if biometric data is involved

The table is a starting point for the conversation with legal and does not classify any specific case. Agents that read customer conversations, described in AI in customer service, often fall into more than one row.

What HR and L&D need to know

HR shows up twice on this map. Recruitment, promotion, termination and performance evaluation are high risk under both the AI Act and PL 2338, and the AI Act requires employers using a high-risk system at the workplace to inform workers beforehand (Article 26(7)). Anyone buying an AI screening tool needs to know how it decides and who reviews the result, even when operating only in Brazil, because LGPD Article 20 already applies.

The second point is training. Since February 2025, Article 4 of the AI Act required ensuring a sufficient level of AI literacy among those who operate the systems. The Omnibus rewrote the rule: companies must support the development of that literacy, with no obligation to guarantee a specific level for each person (European Parliament and Council, 2026). The legal requirement got lighter, and the operational need remains: whoever classifies a use by risk or reviews an automated decision has to have learned how. To measure it, track how many AI uses are classified and how many questions reach legal before a tool launches.

AI regulation in Brazil still depends on the Chamber of Deputies, and a board that waits for the law to be signed before starting will have to build its inventory, classification and documentation on a tight deadline. The in-company applied AI training works with leaders and sales, marketing, CS and HR teams on the company’s own processes and delivers a prompt library by area and an agent architecture, showing what each agent reads, what it executes and who approves, which is the basis for the inventory and risk classification described here.

Frequently asked questions

Is there an AI law in Brazil?

There is no general AI law in force. PL 2338/2023 was approved by the Senate in December 2024 and, on October 22, 2026, was awaiting the rapporteur’s report in the Chamber’s special committee. Meanwhile, the LGPD, the Consumer Protection Code and sector rules continue to apply to the use of AI.

What is the maximum AI Act fine?

For using a prohibited practice, up to 35 million euros or 7% of total worldwide annual turnover for the preceding financial year, whichever is higher. Other operator infringements are capped at 15 million euros or 3%, and misleading information to authorities at 7.5 million euros or 1%. For SMEs the lower of the two amounts applies, and the Omnibus extended that rule to small mid-caps in the two lower tiers.

Does the AI Act apply to Brazilian companies?

It applies when the company places an AI system on the European market or when the output produced by the system is used in the European Union, under Article 2. A company operating only in Brazil, with no customers or users in Europe, falls outside the regulation’s direct reach. Confirm your situation with legal.

Has the AI Act been postponed?

Partly. Regulation 2026/1744 postponed the high-risk obligations to December 2, 2027 (Annex III) and August 2, 2028 (regulated products under Annex I). Prohibitions have applied since February 2025, the rules for general-purpose models since August 2025 and Article 50 transparency since August 2026.

What role will the ANPD play in AI regulation?

The Senate text of PL 2338 and the government’s PL 6237/2025 place the ANPD as coordinator of the national AI regulation system, alongside sector regulators. Today, without the law, the ANPD acts on AI through the LGPD and lists AI as a priority item in its Regulatory Agenda 2025-2026.

How should we prepare the team for AI regulation?

Start with leaders, who inventory and classify their area’s AI uses, then train the people who operate agents and tools day to day on the company’s transparency and human review rules. Track how many uses are classified, how many agents have a named reviewer and how many questions reach legal before each launch.